A Guide to Stopping Kill-Chain Ransomware with a Control Blueprint

Chapter 1About this guide

This guide is written for security, infrastructure and risk leaders who need to stop ransomware moving, spreading or reaching the crown jewels. It explains one Control Blueprint, CP-01, in plain terms: the failure it addresses, the Control Modules it uses, how those modules work together, and how a deployment is scoped.

Control by Firevault is a suite of nine purpose-built modules: a set of tools and techniques that give you physical control over the paths into and across your estate. A Control Blueprint is a proven combination of those modules assembled for a specific outcome. This guide covers one blueprint. The Control overview covers the nine modules and the full set of blueprints.

Chapter 2The problem this blueprint addresses

Ransomware rarely succeeds at the point of entry. It succeeds in the movement that follows: credential reuse, lateral hops between zones, and a clear path to the systems that matter most. Logical segmentation and policy alone do not stop that movement once an attacker holds a valid session.

Chapter 3CP-01 at a glance

• Lead layer FIRE
• Primary modules Firebreak, Isolate, Execute
• Supporting modules Unlink, Lock
• Typical sectors Financial services, healthcare, public sector and defence

Chapter 4The primary modules

These modules do the work the blueprint is named for.

• Firebreak physically breaks the connection path, so a route only exists when it is deliberately opened.
• Isolate separates an environment at hardware level, so a compromised zone cannot reach a clean one.
• Execute fires the control action on signal, without waiting for a change window.

Chapter 5The supporting modules

These modules round out the pattern and are usually added as the deployment matures.

• Unlink removes the always-on dependencies that quietly tunnel between zones.
• Lock holds access to the systems that matter behind identity and condition controls.

Chapter 6What good looks like

• Movement between zones requires a physical path that is closed by default.
• Containment is triggered by signal, not by a change request.
• The crown jewels remain unreachable even when identity is compromised.
• Every control action is recorded locally as evidence.

Chapter 7How the blueprint is deployed

Control Modules are a suite of tools and techniques deployed within your own estate and applied to the paths they govern: at a boundary, inside a zone, or at a third-party edge. Authorisation and evidence remain local, so losing connectivity to Firevault never opens a path.

Most deployments start with a single boundary or zone, prove the control behaviour, then extend the same blueprint across the estate. Modules can be customer-operated or co-managed.

Chapter 8How to scope it

Scoping starts with the paths, not the product. A short discovery exercise identifies the boundaries that matter, who needs to cross them, how often, and what evidence is required. That produces the module count and placement, which in turn produces the price. Blueprints are combined where an estate has more than one problem to solve.

Chapter 9Next steps

• Read the full blueprint detail: CP-01 blueprint
• See all nine modules and the other blueprints: Control by Firevault
• Talk it through with our team: contact Firevault